Fifty US dollars. That’s the average cost of each successful breach in a cyberattack campaign that, between late September and October 2026, targeted more than 1,200 online stores across four countries. What sounds like a rounding error is, according to a Reuters investigation published on October 19, 2026, the real balance sheet of a campaign that shows just how dramatically AI agent hacking is changing the rules of cybersecurity. Over 100 companies were successfully compromised, including well-known names such as John Deere, SharkNinja, and Cummins.
This is no longer a textbook example for theoretical risk research. It marks a turning point: autonomous AI systems are now taking over tasks that previously required entire teams of specialized hackers.
Table of Contents
Key Takeaways
- Starting September 25, 2026, a Chinese-speaking attacker used AI agents to automatically target e-commerce websites in the US, Canada, Australia, and Japan.
- Of more than 1,200 attacked websites, over 100 companies were successfully compromised, including Deere, SharkNinja, and Cummins.
- The campaign combined DeepSeek models with Anthropic’s Claude Code, run through the open platform Cairn.
- Total AI token costs amounted to roughly $5,000 — about $50 per successful breach.
- A successful attack took about 23 hours on average, directed by instructions of fewer than 100 Chinese characters.
What Actually Happened in the Campaign
According to Reuters’ exclusive report, the attacker began systematically deploying AI agents against e-commerce platforms on September 25, 2026. Snorre Fagerland, Principal Threat Researcher at cybersecurity firm NorForge, documented that the agents attempted to breach more than 1,200 websites. Over 100 of them were successfully compromised.
Affected companies include:
- Deere (John Deere), the agricultural machinery manufacturer, stated there was no evidence that sensitive data had been accessed.
- SharkNinja, the household appliance maker, said only a standalone support website was affected and that the threat has since been contained.
- Cummins, the engine manufacturer, is currently investigating a possible attack on a website operated by a third party.
These responses reveal a typical pattern: the affected corporations themselves were not hit at their core, but rather adjacent web infrastructure, often run by third-party providers. That is exactly what makes this case particularly relevant for smaller companies, which often lack the resources to secure such peripheral systems.
The Technology Behind AI Agent Hacking
Technically, the campaign relied on a combination of two powerful AI model families: DeepSeek’s models and Anthropic’s Claude Code. Both were run through an open AI platform called Cairn, an open-source tool marketed as a “general-purpose problem-solving engine.”
Cairn appears to be popular among hackers because numerous instances are publicly accessible and unprotected online. Starting around October 2, 2026, Fagerland discovered roughly two dozen such openly accessible, abused Cairn installations.
Cairn’s developer, who goes by the social media handle “le1xia0,” confirmed receiving Reuters’ inquiry. In a post on X, however, he emphasized that the software was not built for hacking attacks.
Why the Scale and Cost Are So Concerning
The real paradigm shift isn’t the attack method itself, but its efficiency:
| Metric | Value |
|---|---|
| Websites attacked | over 1,200 |
| Companies successfully compromised | over 100 |
| Average attack duration | ~23 hours |
| Total campaign cost | roughly $5,000 |
| Cost per successful breach | roughly $50 |
| Length of attacker instructions | under 100 Chinese characters |
These numbers illustrate the core risk of AI agent hacking: a single person, with minimal input — fewer than 100 characters of instruction — could launch a campaign that ran autonomously for weeks, probed a thousand targets, and successfully infiltrated a hundred companies. The roughly $5,000 investment is in the range of a single month’s salary, not the realm of classic, expensive cybercrime infrastructure.
“The barrier to entry for complex, multi-stage attacks drops dramatically once AI agents take over the actual execution work.”
Context: Not an Isolated Case, But a Trend
This case fits into a series of similar incidents showing that AI agent hacking is no longer a theoretical danger, but has already been documented in practice multiple times. Code404Zero previously reported on a comparable incident: an AI agent hacking attempt against a Canadian government website.
Israeli security firm Gambit Security already reported in August 2025 on Russian-speaking extortionists using the AI tool Cursor AI to breach seven organizations. In September 2025, Gambit documented an even larger campaign: 25 companies were compromised and at least 600,000 credit card records were stolen.
The trajectory over roughly a year and a half shows a clear line:
- Summer 2025: Individual, targeted AI-assisted attacks on a handful of organizations.
- Fall 2025: Significantly larger scale, with concrete data theft at substantial volume.
- Fall 2026: Broadly automated mass campaign against over a thousand targets simultaneously, with a consistent success rate across multiple countries.
This chronology suggests that attackers are continuously refining and scaling their tools and processes, while many companies have yet to adapt their defenses accordingly.
Why This Means the Democratization of Cyberattacks
The term “democratization” may sound contradictory in this context, but it hits the nail on the head. Previously, a successful, multi-stage attack on a mid-sized company required:
- Specialized technical knowledge of vulnerabilities and exploits
- Time for manual reconnaissance and adapting the attack strategy
- Teams with different roles, e.g. for reconnaissance, exploitation, and data exfiltration
By deploying autonomous AI agents, these roles merge into a single, cheaply accessible system. An attacker with limited technical background can trigger an agent with a short instruction that independently searches for vulnerabilities, tests attack paths, and proceeds iteratively over hours — without constant human intervention.
This significantly lowers the barrier to entry for cybercrime. At the same time, it doesn’t mean every organization is equally at risk. The affected websites in this case were predominantly e-commerce platforms, often running on third-party infrastructure — classic targets with potentially weaker protection than the core systems of large corporations.
Risks for Companies, Especially Smaller E-Commerce Operators
For IT leaders and developers, this case offers several practical lessons.
Third-party infrastructure as a weak point: In both the SharkNinja and Cummins cases, it wasn’t core infrastructure that was affected, but standalone support or third-party websites. Such peripheral systems are often patched and monitored less frequently.
A roughly 23-hour window: The average attack duration of about 23 hours shows that automated attacks don’t happen in seconds, but proceed iteratively over a longer period. That theoretically opens a detection window — provided functioning monitoring exists.
Open AI platforms as an entry point for attacker tools: The roughly two dozen openly accessible Cairn installations that Fagerland found highlight a structural problem: open-source AI tools are often run without adequate access controls, making them attractive for abuse.
For smaller e-commerce operators, this translates into a clear priority: not just the main website, but also connected support portals, payment modules, and third-party services need to be regularly checked for vulnerabilities.
Practical Protective Measures Against AI Agent Hacking
The following measures reduce the risk of becoming the target of an automated AI agent campaign:
- Regular security audits, including for peripheral systems and third-party websites
- Deploying web application firewalls with detection for unusual, machine-generated access patterns
- Strict patch management, especially for publicly reachable admin interfaces
- Monitoring login attempts over longer periods, not just short-term spikes
- Access restrictions for self-hosted AI tools and open development platforms
How Companies and Platform Operators Should Respond
The responses from Deere, SharkNinja, and Cummins show varying degrees of transparency, but follow a similar pattern: swift investigation, containment, and public communication without downplaying the issue, yet without triggering panic. This approach can serve as a model.
Platform operators, such as Cairn’s developer, are also increasingly responsible for securing their systems against abuse, for example through mandatory authentication instead of freely accessible instances. The developer’s statement that the platform wasn’t designed for hacking purposes doesn’t change the fact that exactly this openness was exploited by attackers.
Conclusion and Next Steps
The case surrounding the campaign involving Claude Code, DeepSeek, and the Cairn platform makes clear: AI agent hacking is no longer a distant future scenario, but already an effective, low-cost tool for cybercriminals today. At roughly $50 per successful breach and minimal orchestration effort, the economics for attackers have fundamentally shifted.
At the same time, panic is not a useful advisor. The known cases predominantly affected peripheral systems and third-party infrastructure, not necessarily the most critical company cores. IT leaders and developers who want to act should concretely:
- Conduct an inventory of all publicly reachable websites and subsystems, including third-party services.
- Configure monitoring systems to detect inconspicuous access patterns spread over hours, not just spikes.
- Review the use of open AI platforms within their own organization and secure them where necessary.
- Expand incident response plans to cover scenarios specifically tailored to automated, AI-driven attacks.
The developments of the past year and a half — from individual Cursor AI attacks, through the Gambit Security cases, to the current Cairn campaign — suggest this trend will continue. Companies that invest now in transparency, monitoring, and securing their entire digital supply chain will be in a far better position than those waiting for the next incident.
